CVE-2026-116576

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString in lib/util.js. On Windows, the sanitizer removes ASCII...

EUVD-2026-110317

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString in lib/util.js. On Windows, the sanitizer removes ASCII...

CVE-2026-116576

The systeminformation library for node.js is vulnerable to Windows command injection in the services() function prior to version 5.33.16 . The root cause is that the sanitizeShellString() function in lib/util.js fails to filter Unicode quotation marks , which PowerShell accepts as string delimite...

CVE-2026-116576 systeminformation: Windows command injection in services() through Unicode quotation marks

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString in lib/util.js. On Windows, the sanitizer removes ASCII...